Cloud Security Analyst

• Directly own data security across some cloud SaaS platforms and partner with other platform owners to ensure current best practices are implemented to secure each platform individually while collectively securing the entire corporate platform umbrella.
• Configure, harden, and maintain data security settings across cloud SaaS platforms and other business applications.
• Manage and review identity and access controls, including SSO, MFA, conditional access, role and permission models, sharing settings, and privileged accounts.
• Implement and maintain data protection controls such as data loss prevention (DLP), sensitivity labels, encryption settings, field-level security, and external sharing policies.
• Build, tune, and maintain monitoring, logging, and event detection for SaaS environments, including audit log collection, alert rules, and integration with SIEM and security tooling.
• Triage and investigate security alerts and suspicious activity, such as anomalous logins, data exfiltration, risky OAuth or third-party app connections, and unauthorized configuration changes.
• Proactively hunt for threats, misconfigurations, and posture drift using SaaS Security Posture Management (SSPM), CASB, native security consoles, and other tools.
• Lead remediation of identified threats and vulnerabilities, coordinating with platform owners, administrators, and IT teams to drive issues through to closure.
• Participate in security incident response for SaaS-related events, including containment, evidence collection, root-cause analysis, and post-incident follow-up.
• Identify repetitive manual work and create or improve scripts, automated detections, dashboards, playbooks, and workflows that reduce operational effort.
• Create and maintain security baselines, configuration standards, runbooks, and procedures, so knowledge is not concentrated with a single person.
• Support access reviews, audits, and compliance activities (such as SOC 2, ISO 27001, and privacy requirements) for assigned SaaS platforms.
• Review new SaaS applications, integrations, and significant configuration changes for security risk, and advise on secure implementation.
• Learn additional SaaS platforms over time as organizational needs change and applications are introduced, modernized, replaced, or retired.

Role Scope

The primary focus of this role is hands-on security configuration, monitoring, and threat response for cloud SaaS environments. The Cloud Security Analyst will be expected to independently resolve routine and moderately complex security issues, perform meaningful investigation before escalating, and steadily expand the set of platforms they can secure.

Supported platforms may include Salesforce, ServiceNow, Microsoft 365, collaboration and file-sharing tools, and other SaaS applications assigned to the team.

Deeper security architecture, infrastructure, and application engineering work will continue to be handled in partnership with the appropriate subject-matter experts and platform owners. The goal of this role is not to replace those specialties, but to provide strong first-line security ownership of our SaaS footprint, so senior resources are engaged when their expertise is needed.

• Experience in information security, security operations, cloud security, identity and access management, systems administration, or a related technical discipline.
• Hands-on experience administering or securing at least one major SaaS platform, such as Salesforce, ServiceNow, or Microsoft 365.
• Understanding of core security concepts, including least privilege, identity federation (SAML, OAuth, OIDC), MFA, encryption, data classification, and logging.
• Ability to read and interpret audit logs, sign-in events, security alerts, and technical documentation.
• Strong troubleshooting and analytical problem-solving skills, including the ability to work through unfamiliar security problems methodically.
• Familiarity with scripting or query languages (such as PowerShell, Python, KQL, or SOQL) and the ability to automate repeatable security tasks.

Detection and response

• Experience with triaging security alerts and investigating suspicious activity through to resolution.
• Ability to distinguish between a routine security event and an incident that requires escalation or broader response.
• A mindset of ownership: investigate before escalating, document what was learned, and look for ways to prevent recurring issues.

Continuous improvement

• Looks for opportunities to strengthen security posture through automation, better detections, tooling, documentation, or process improvements.
• Able to make practical security improvements that balance risk reduction with business usability, without over-engineering the solution.
• Interested in improving supportability and reducing dependence on tribal knowledge or a single subject-matter expert.

Communication and collaboration

• Able to explain security risks and recommendations clearly to both technical and non-technical audiences.
• Able to document security standards, procedures, and investigation steps in a way others can follow.
• Comfortable collaborating across IT, application administration, infrastructure, compliance, legal, and business teams.

Preferred Experience

Experience with one or more of the following is beneficial, but experience across all areas is not required:

• Microsoft security stack: Entra ID, Defender for Cloud Apps, Defender XDR, Purview (DLP, sensitivity labels, Insider Risk), and Sentinel.
• Salesforce Shield (Event Monitoring, Platform Encryption, Field Audit Trail) and Salesforce security configuration.
• ServiceNow security administration, access control lists (ACLs), and instance hardening.
• SaaS Security Posture Management (SSPM) or Cloud Access Security Broker (CASB) tools.
• SIEM or SOAR platforms, log ingestion, and detection engineering.
• Identity platforms such as Okta or Entra ID, including SSO and lifecycle management.
• Security frameworks and benchmarks such as NIST CSF, CIS Benchmarks, MITRE ATT&CK, SOC 2, or ISO 27001.
• Security certifications such as Security+, CySA+, CCSP, Microsoft SC-200 / SC-300 / SC-401, or Salesforce Security and Administrator credentials.

Base Salary Range: $120,000 to $150,000. The final salary and offer will be determined by the applicant’s background, experience, and skills.